-
-
[求助]关于OllyBone里面的GetPteAddress,请用过的帮下忙
-
发表于:
2008-11-26 12:25
7081
-
[求助]关于OllyBone里面的GetPteAddress,请用过的帮下忙
PPTE GetPteAddress( PVOID VirtualAddress )
{
PPTE pPTE = 0;
__asm
{
cli //disable interrupts
pushad
mov esi, PROCESS_PAGE_DIR_BASE
mov edx, VirtualAddress
mov eax, edx
shr eax, 22
lea eax, [esi + eax*4] //pointer to page directory entry
test [eax], 0x80 //is it a large page?
jnz Is_Large_Page //it's a large page
mov esi, PROCESS_PAGE_TABLE_BASE
shr edx, 12
lea eax, [esi + edx*4] //pointer to page table entry (PTE)
mov pPTE, eax
jmp Done
//NOTE: There is not a page table for large pages because
//the phys frames are contained in the page directory.
Is_Large_Page:
mov pPTE, eax
Done:
popad
sti //reenable interrupts
}//end asm
return pPTE;
}//end GetPteAddress
用这段代码出了问题 会引起蓝屏
看了下应该是下面的地方出的问题
test [eax], 0x80 //is it a large page?
也就是当前的地址不能读取 请问为什么出现这个问题
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)